aws: Update EBS CSI driver to v1.47.0

[hakman]

This also removes any dependency on the public.ecr.awsregistry.

/cc @rifelpet @ameukam @torredil

[hakman]

/retest

[hakman]

/override pull-kops-e2e-aws-upgrade-k132-ko132-to-klatest-kolatest-many-addons

[k8s-ci-robot]

@hakman: Overrode contexts on behalf of hakman: pull-kops-e2e-aws-upgrade-k132-ko132-to-klatest-kolatest-many-addons

In response to this:

/override pull-kops-e2e-aws-upgrade-k132-ko132-to-klatest-kolatest-many-addons

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[hakman]

/test pull-kops-e2e-k8s-aws-amazonvpc
/test pull-kops-e2e-k8s-gce-ipalias

[ameukam]

/lgtm

[rifelpet]

we could make this easier for next time if we persisted the values overrides for the image registry:

https://github.com/kubernetes-sigs/aws-ebs-csi-driver/blob/7ab5c68a7705536d87a28fbe2b90ee8fe85b79af/charts/aws-ebs-csi-driver/values.yaml#L6

Suggested change

	#helm template aws-ebs-csi-driver aws-ebs-csi-driver/aws-ebs-csi-driver -n kube-system \
	#helm template aws-ebs-csi-driver aws-ebs-csi-driver/aws-ebs-csi-driver -n kube-system \
	# --set image.repository=registry.k8s.io/provider-aws/aws-ebs-csi-driver \
	# --set nodeDriverRegistrar.image.repository=registry.k8s.io/sig-storage/csi-node-driver-registrar \

etc.

[hakman]

Not that much, they still add some eks-specific suffixes.... 😞
At least this way it's clear that it's totally different images.

[rifelpet]

I'm slightly concerned that the ECR image forks have significant changes from the registry.k8s.io images.

ECR doesnt have node-driver-registrar v2.14.0, but comparing v2.13.0:

 docker history public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-33-latest
IMAGE          CREATED        CREATED BY                                      SIZE      COMMENT
ab823174114d   10 days ago    ENTRYPOINT ["/csi-node-driver-registrar"]       0B        buildkit.dockerfile.v0
<missing>      10 days ago    COPY bin/node-driver-registrar/linux-arm64/c…   18.4MB    buildkit.dockerfile.v0
<missing>      10 days ago    COPY ATTRIBUTION.txt /ATTRIBUTION.txt # buil…   36.8kB    buildkit.dockerfile.v0
<missing>      10 days ago    COPY LICENSES /LICENSES # buildkit              377kB     buildkit.dockerfile.v0
<missing>      10 days ago    ARG TARGETOS                                    0B        buildkit.dockerfile.v0
<missing>      10 days ago    ARG TARGETARCH                                  0B        buildkit.dockerfile.v0
<missing>      4 months ago   COPY /newroot / # buildkit                      6.15MB    buildkit.dockerfile.v0
<missing>      4 months ago   USER 0                                          0B        buildkit.dockerfile.v0
<missing>      4 months ago   ENV PATH=/usr/local/sbin:/usr/local/bin:/usr…   0B        buildkit.dockerfile.v0

 docker history registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.13.0
IMAGE          CREATED        CREATED BY                                      SIZE      COMMENT
41646657b015   7 months ago   ENTRYPOINT ["/csi-node-driver-registrar"]       0B        buildkit.dockerfile.v0
<missing>      7 months ago   COPY ./bin/csi-node-driver-registrar-arm64 c…   27.1MB    buildkit.dockerfile.v0
<missing>      7 months ago   ARG binary=./bin/csi-node-driver-registrar      0B        buildkit.dockerfile.v0
<missing>      7 months ago   LABEL description=CSI Node driver registrar     0B        buildkit.dockerfile.v0
<missing>      7 months ago   LABEL maintainers=Kubernetes Authors            0B        buildkit.dockerfile.v0

I'm wondering if the ECR fork includes any changes that we need and would lose if we switch to registry.k8s.io.

[hakman]

I'm wondering if the ECR fork includes any changes that we need and would lose if we switch to registry.k8s.io.

@torredil Any thoughts on this Q? Personally, I would prefer to stick with community images, if possible.

[torredil]

@hakman

I'm wondering if the ECR fork includes any changes that we need and would lose if we switch to registry.k8s.io.

You won't lose any functionality - we fully support using the community sidecar images(registry.k8s.io). The main difference is that the AWS-owned images published to public.ecr.aws will have less CVEs (they are built using a minimal base image, and CVEs are patched regularly, weekly / bi-weekly cadence depending on the severity of the report).

[hakman]

/override pull-kops-e2e-aws-upgrade-k132-ko132-to-klatest-kolatest-many-addons
/override pull-kops-e2e-k8s-gce-cilium

[k8s-ci-robot]

@hakman: Overrode contexts on behalf of hakman: pull-kops-e2e-aws-upgrade-k132-ko132-to-klatest-kolatest-many-addons, pull-kops-e2e-k8s-gce-cilium

In response to this:

/override pull-kops-e2e-aws-upgrade-k132-ko132-to-klatest-kolatest-many-addons
/override pull-kops-e2e-k8s-gce-cilium

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[hakman]

@hakman

I'm wondering if the ECR fork includes any changes that we need and would lose if we switch to registry.k8s.io.

You won't lose any functionality - we fully support using the community sidecar images(registry.k8s.io). The main difference is that the AWS-owned images published to public.ecr.aws will have less CVEs (they are built using a minimal base image, and CVEs are patched regularly, weekly / bi-weekly cadence depending on the severity of the report).

Ah, cool, thank you for the explanation @torredil! 🙂

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rifelpet

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [rifelpet]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment